OSVDB ID: 35511 Title: Mbedthis AppWeb HTTP TRACE Method XSS |
Info |
|
|
Dates |
||||
|
|
Description |
appweb contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when using request with HTTP TRACE method in conjonction with certain browsers, which will disclose users's cookies or authentication data information resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified, Vendor Verified OSVDB: Web Related |
Solution |
Upgrade to version 2.2.2 or higher, as it has been reported to fix this vulnerability.(TRACE method is disabled by default) Additionally, implementing the following change: set the 'TraceMethod' option to 'off' in appweb.conf. |
Products |
|
References |
|
Credit |
|